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PREFACE 


This study was initiated as Subtask 3, Orbiting Propellant Depot Safety Study 
of NASA Study C-II, Advanced Missions Safety Studies. Other studies in this 
series are: (i) Subtask 1, TNT Equivalency Study, Aerospace Report No. 
ATR-7 1( 7233)-4; and (ii) Subtask 2, Safety Analysis of Parallel versus 
Series Propellant Loading of the Space Shuttle, Aerospace Report No. 

ATR-7 1(72 33)- 1. 

The study was supported by NASA Headquarters and managed by the Advanced 
Missions Office of the Office of Manned Space Flight. Mr. Herbert Schaefer, 
the Study Monitor, provided guidance and counsel that signifantly aided this 
effort . 


Study results are presented in three volumes; these volumes are summarized 
as follows: 

Volume I: Management Summary Report presents a brief, concise 
review of the study content and summarizes the principal conclusions 
and recommendations . 

Volume II: Technical Discussion provides a discussion of the 

available test data and the data analysis. Details of an analysis 
of possible vehicle static failure modes and an assessment of 
their explosive potentials are included. Design and procedural 
criteria are suggested to minimize the occurrence of an explosive 
failure . 

Volume III: Appendices contains supporting analyses and backup 
material. 
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1. INTRODUCTION 


1. 1 GENERAL 

Under consideration are orbital missions that require the use of orbiting 
vehicles, e.g., a cislunar shuttle, that is either chemically or nuclear pro- 
pelled, functioning as orbit-to-orbit shuttles combined with space tugs for 
servicing earth- orbiting payloads. The flight frequency of these space-based 
vehicles may require that large quantities of propellants will have to be 
delivered to orbit for their use. 

Orbiting propellant depots (OPD), in both geocentric and selenocentric orbits, 
are being considered as candidate methods of making the required propellants 
readily available. 

This report presents the results of a top level study assessing the gross 
requirements and concomitant safety hazards associated with the operation of 
several configurations of the OPD. A qualitative cause-and-effect approach 
was employed throughout the study, and no consideration was given to the 
probability of a particular failure's occurring. The reader is reminded that 
the identification of safety hazards and their rectification are an iterative 
process and that a further safety evaluation should be performed after the OPD 
will have been better defined. 

1. 2 STUDY OBJECTIVES 

The objective of this study was to establish design, operation, and emergency 
procedure guidelines, criteria, and requirements for the OPD and its operation. 

1. 3 STUDY SCOPE 

The objective of this study was to analyze the potential safety hazards of an OPD 
in geocentric or selenocentric orbit and the hazardous interactions between the 
OPD Propellants Depot and transient space vehicles such as Space Shuttles and 
Space Tugs. 
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1.4 GROUND RULES AND CONSTRAINTS 

The ground rules and constraints utilized throughout this study included: 

a. The OPD must be capable of unmanned operation but be 
safe for servicing manned vehicles. 

b. The OPD is to be composed of components within the size 
and weight limitations of the Space Shuttle payload bay. 

c. The conceptual designs will not require significant advance- 
ment in the state of the art. 

d. The OPD will service one User OV at a time and will be the 
active vehicle during transfer operations, i. e. , will supply 
power, guidance, acceleration, etc. 

e. All docking points will be part of. a universal docking 
mechanism which will be common to all using vehicles. 

f. Propellants will be stored at the conditions (temperature and 
pressure) required by the vehicles to be serviced. 

g. The quantity of propellants transferred will be measured by 
the OPD. 

h. Only series transfer of propellants will be possible. 

i. Resupply of the OPD will be accomplished via a Space Shuttle. 

j. No propellants will be returned to earth. 

1. 5 STUDY PLAN 


1. 5. 1 Approach 

The principal steps in the study included: 


a. Development of conceptual OPD configurations to the level 
required to serve as the baseline for a top-level hazards 
analysis. 

b. Development of top-level functional flows for each 
configuration. 

c. Performing a gross hazards analysis based on the top-level 
functional flows. 

d. Assessment and comparison of the levels of safety inherent 
in the concepts. 

e. Provide recommendations as to safety requirements for 
normal and emergency operation. 
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1 . 5 . 2 


Resources /Data Base 


Since the study was primarily a hazards analysis, NASA and contractor 
technical reports, documents, and briefings were utilized to the maximum 
extent possible in establishing the OPD configurations. The reports were also 
utilized in selecting subsystems and defining their modes of operation. Refer- 
ences to the specific reports actually utilized or reviewed are given throughout 
this volume in the pertinent sections to which they apply. 



2. CONCEPTUAL OPD CONFIGURATIONS 


2. 1 GENERAL 

Before the hazards analysis could be performed, several conceptual con- 
figurations of the OPD had to be considered; existing data were used 
whenever possible. It was intended that the configurations be defined only to 
the extent necessary to support a top-level hazards evaluation. 

The following paragraphs describe, in gross terms, the major structural 
and operational aspects of the conceptual OPD configurations evaluated in this 


study . 


2.2 

INTEGRAL CONCEPT 

2.2. i 

Structural 


An integral configuration of the OPD is illustrated in Figure 2-1. In this 
concept, the cryogenic propellant storage tanks, LO^ and LH^, are a per- 
manent part of the OPD structure. Although large single tanks are shown 
for each propellant, an acceptable alternate would be a series of intercon- 
nected smaller tanks. Another tank configuration would incorporate a single 
large common bulkhead-type storage tank that would contain both propellants; 
this tank configuration was excluded from the study since a single failure in 
the common bulkhead would allow the propellants to mix. 

The subsystems required to operate the OPD were assumed to be integrated 
with the tank structure; the subsystems that would be used to dispense propel- 
lants would be used during OPD resupply operations. The rationale for selec- 
tion of specific subsystems and their operations is discussed in greater detail 
in Appendix A. 
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INTEGRAL CONCEPT 


ALTERNATE CONCEPT 


L0 2 TANK 



DOCKING 

PORT 


LHoTANK 


SUBSYSTEM 

HOUSING 



• CHARACTERISTICS 

i PROPELLANT STORAGE TANKS PERMANENT PART OF 
OPD STRUCTURE 

ii SUBSYSTEMS INTEGRATED WITH TANK STRUCTURE 
iii TANKER OR MODULAR RESUPPLY 


Figure 2-1. Integral Concept 


2.2.2 Operational 

2.2.2. 1 Resupply 

Three methods of resupply were considered in conjunction with this OPD 
configuration: 

a. Probe and drogue 

b. Modular resupply tank 

c. Hard dock of resupply OV 

The probe and drogue method. Figure 2-2, is similar to that presently 
utilized for air-to-air refueling of aircraft. This method eliminates the 
requirement for a hard dock and minimizes the effects that instability of one 
vehicle would impose on the other. However, this system is the most complex 
of the three, both structurally and operationally. Also, the transfer boom is 
vulnerable to damage due to excessive motion of either the OPD or the resupply 
vehicle . 

The modular method, Figure 2-3, of resupply appears to be the most desirable. 
In this method, a propellant tank module carried in the payload bay of the 
affected resupply OV would be docked to the propellant transfer part of the OPD. 
The resupply OV then would retreat to a safe distance from the OPD prior to 
the actual transfer of propellants. When the transfer was complete, the resup- 
ply OV would remove the empty module and return it to earth for refurbishment. 

Hard docking and transferring propellants directly from the resupply OV to 
the OPD was excluded from the analysis. The main reasons for this were 
potential hazards involved in docking such large vehicles and their relatively 
slow reaction times in the event of emergenc(y)(ies) requiring vehicle separa- 
tion. 

2. 2. 2. 2 User OV Servicing 

Propellants would be flow-transferred to the user OV that has docked at the 
OPD resupply port. The docking mechanism is discussed in Appendix B. 
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DOCKING 

PORT 






CHARACTERISTICS 

i UTILIZATION OF PROPELLANT TRANSFER PROBES 
SIMILAR TO AIRCRAFT AIR-TO-AIR REFUELING 

ii TRANSFER SUBSYSTEMS CONTAINED IN OPD 

iii OV/OPD REQUIRED ACCELERATION DURING TRANSFER 


Figure 2-2. Probe and Drogue Resupply, Integral Concept 



CHARACTERISTICS 

0 v DELIVERS FULL TANK AND STANDS OFF DURING TRANSFER 
VIA OPD SUBSYSTEMS 


Figure 2-3. Modular Resupply, Integral Concept 
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During the period of propellant transfer, all functions, acceleration, stabiliza- 
tion, power, flow control, etc., would be supplied by the OPD while the user 
OV is quiescent, except that it would monitor operations and provide backup 
capability for the more critical subsystems of the OPD. 

The propellant transfer procedure utilized in this study is outlined in Table 2-1. 
2.3 SEMIMODULAR CONCEPT 

2.3.1 Structural 

Figure 2-4 presents a conceptual semimodular configuration for the OPD. This 
configuration would consist of replaceable propellant storage modules and a 
central core that would contain the subsystems required for operation of the 
OPD. The subsystems contained within the core are identical to those required 
to operate the conceptual integral configuration of the OPD. 

Spaced along the longitudinal axis of, and at 90 deg intervals around, the cen- 
tral core would be a series of manifolded docking ports for propellant storage 
modules. DO^ and LH^ are contained in separate modules and in discrete 
planes: LO^ modules would be in one plane, and LH^ modules in the other. 

Each docking port would incorporate the interface connectors necessary to 
link the propellant modules to the OPD's propellant transfer system. The 
docking port interface is discussed in Appendix B. 

2.3.2 Operational 

2.3.2. 1 Resupply 

The conceptual semimodular OPD would utilize a modular method of resupply. 
The technique employed in delivering a module to the depot would be the same 
as that described in paragraph 2.2.2. 1 for the modular resupply of the inte- 
gral OPD with one notable exception; propellants would not be pumped from 
the module to the OPD tanks. 

In this configuration, the resupply OV modules would become the onorbit 
storage tanks for the depot. Propellants would be pumped directly from the 
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Table 2-1, Propellant Transfer 
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Table 2-1. Propellant Transfer Procedures (Continued) 
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Table 2-1. Propellant Transfer Procedures (Continued) 
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CHARACTERISTICS 

i MODULAR OPD WITH CENTRAL MANIFOLDING AND SUBSYSTEMS 

ii MODULAR RESUPPLY WITH INTEGRAL TRANSFER TO USER OV 


Figure 2-4. Semimodular Concept 
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modules to the user OVs. When empty, the modules would be returned to 
earth by a resupply OV and recycled. 

The semimodular OPD can also function as a modular OPD. To operate in 
this manner, it would be necessary only to retract the interface connectors 
at the docking ports and utilize the propellant supply modules as will be 
described in paragraph 2 . 4 . 2 . 1. 

2. 3. 2. 2 User OV Servicing 

Propellants would be transferred to user OVs in the same manner as that 
described for the integral OPD in paragraph 2. 2. 2. 2. If the OPD were being 
operated in the modular mode, propellant transfer to the user OV would be as 
described in paragraph 2.4. 2. 2. 

2.4 MODULAR CONCEPT 

2.4.1 Structural 

The conceptual modular configuration is shown in Figure 2-5. The central core 
would contain the propulsion and control subsystems and provide a simplified 
docking mechanism for storing the propellant modules. The external profile 
of this configuration is identical to the semimodular concepts, but there are 
several basic internal differences. There would be no requirement for the 
flow transfer of propellants either in or out of the OPD; therefore, there 
would be no propellant transfer subsystems, tank manifolding, or complex 
interfaces at the docking ports. The OPD, in essence, would be a storage 
rack for the propellant modules, each of which would contain both fuel and 
oxidizer. 

2.4.2 Operational 

2.4. 2.1 Resupply 

Propellant modules would be delivered and docked to the OPD via the Space 
Shuttle as shown in Figure 2-4. The docking sequence is discussed in 
Appendix C . 
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CHARACTERISTICS 

i MODULAR RESUPPLY AND TRANSFER TO USER OV 

ii COMPLETE MODULAR OPD WITH NO PROPELLANT TRANSFER 
OR PRESSURIZATION SYSTEMS 


Figure 2-5. Modular Concept 


2.4,2. 2 User OV Servicing 

The user OV would obtain propellants from the OPD by direct tank exchange. 
The user OV would store its empty tanks at the OPD in a vacant docking port 
and then maneuver to acquire a full tank from the OPD. The empty tank 
modules would be recovered by a Space Shuttle for reuse when propellant 
deliveries are made. 

2.4.3 Alternate Modular Concept 

A variation of the modular concept which would minimize some of the dis- 
advantages of the original concept for the former would be the addition of 
an OPD-mounted boom (Figure 2-6). The boom would perform the entire 
propellant tank exchange sequence both to and from the OPD. This concept 
would utilize a simple geometrical packaging of tanks in order to minimize 
the sequencing and control of the boom mechanism. The sequence would be 
pre-programed and controlled from the resupply OV or user OV with manual 
override capabilities and, in essence, would be analogous to a remote 
manipulator . 

The basic advantage over the full modular concept would be that a single 
docking sequence would be involved and there would be a minimum payload 
penalty to the resupply OV since the provisions for tank exchange aboard that 
vehicle would be minimized. 

This approach, however, also introduces some new problems. A fully 
complex boom or manipulator mechanism would be required. Any malfunc- 
tion of this mechanism during the tank exchange sequence could cause severe 
damage to the OPD, the resupply OV, and/or the user OV, with potentially 
serious, if not catastrophic, safety hazards. From an operational viewpoint, 
servicing and maintenance of the boom would pose a very substantial problem 
area. 
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CHARACTERISTICS 

i BOOM PERFORMS COMPLETE TANK EXCHANGE SEQUENCE 
FROM OV TO RACK-MOUNTED OPD TANKS 

ii REMOTE CONTROL FROM OV 


Figure 2-6. Alternate Configuration, Modular Concept 
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3. COMPARISON OF CONCEPTUAL CONFIGURATIONS 


3.1 INTRODUCTION 

Prior to performing the hazards analysis, an overall evaluation of the con- 
ceptual configurations was made to determine the advantages and disadvantages 
of each with respect to both safety hazards and operational features. The 
results of the evaluation are discussed briefly in the following paragraphs. 

3.2 INTEGRAL CONCEPT 

3.2.1 Advantages 

The basic advantages of this concept is that it eliminates the complex mani- 
folding and valving required for the semimodular concept. Also the OPD could 
be resupplied by a dedicated tanker which would improve the propellant pay- 
load capability of the resupply OV . 

Several resupply options are available for this concept. Of these options, 
the probe and drogue and the modular concepts would tend to minimize any 
effects of instability or other differential movement between the vehicles. 

Of these two, the modular concept appears more desirable since the resupply 
OV would stand off at a safe distance throughout the refueling cycle. 

3.2.2 Disadvantages 

The major disadvantage of the integral concept is the requirement for pro- 
pellant phase control, pressurization, and pumping during the propellant 
transfer process. This process could account for the largest number of 
potential malfunctions which might result in safety hazard(s). 

Another undesirable feature of this approach is that a single tank rupture or 
failure could cause loss not only of the entire system but, possibly the OPD 
itself. The use of multiple tanks strapped together, with the necessary 
associated manifolding and valving, could reduce the probability of this 
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occurrence; however, this approach would negate the basic advantage of the 
integral concept. 

Although the probe and drogue resupply method would provide separation 
between the OPD and resupply OV, the complexity of the system and vulner- 
ability to rupture of the connecting line seem at this point to outweigh the 
advantages . 

3.3. SEMIMODULAR CONCEPT 

3.3.1 Advantages 

There are two primary advantages to the semimodular concept: (i) no pro- 

pellant flow would be required to resupply the OPD; since propellants would 
not be required to flow during resupply operations, the need for phase con- 
trol, pressurization, and pumping, that is considered a major disadvantage 
with the integral system, would be eliminated; (ii) the increased operational 
flexibility offered by this concept; the OPD could transfer propellants to 
the user OV via flow transfer from bulk storage tanks or tank exchange as 
would occur in the modular concept. For the latter method to be used, the 
specialized propellant tanks used with the modular OPD would have to replace 
the bulk storage tanks provided in that concept. 

3.3.2 Disadvantages 

The additional complexity of the multiple docking and manifold system could 
increase the possibility of failure which might affect system safety. 

3.4 MODULAR CONCEPT 

3.4.1 Advantages 

A distinct advantage of this configuration would be that no flow transfer of 
propellants would be required and, therefore, the propellant flow transfer 
subsystems would be eliminated. As a result, the basic OPD is the least 
complex of the concepts studied. 
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3 . 4.2 


Disadvantages 


The propellant tank modules used with this configuration would contain both 
the fuel and the oxidizer. Most of the data reviewed indicated that a tank- 
within-a-tank configuration or a single tank with a common bulkhead configura- 
tion could be used for these dual propellant modules; single point failure of 
the bulkhead or inner tank wall would allow propellants to mix, resulting in 
potential fire or explosion, i.e., catastrophic failure. 

Extensive maneuvering of the user OV would be required in the vicinity of 
the OPD. The user OV would be required to dock at the OPD, disengage the 
empty tank, maneuver to and dock with a full tank. 
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4. HAZARDS ANALYSIS 


4. 1 GENERAL 

A qualitative approach was used throughout the analysis which was divided into 
three categories: system, components within systems, and interfaces between 

the systems. Although the safety hazards for three different OPD configurations 
were considered, many of the hazards identified are applicable to several of 
them. This results from the fact that some subsystems and operating procedures 
are common to two or more of the concepts, e. g. : (i) the flow transfer of pro- 
pellants from the OPD to the user OV would employ the same subsystems and 
operational procedures in both the integral and semi-modular concepts; (ii) 
the docking mechanism and its operation are common to all concepts. 

4. 2 HAZARDS ANALYSIS FORMAT 

Table 4-1 shows the form utilized for the hazard analysis. The following 
paragraphs contain a description of each column on the form. 

4. 2. 1 Nomenclature 

This column serves two functions: (i) to give the category of the analysis, i. e. , 
system, component, or interface; (ii) to identify the specific item within the 
category and give a brief description of its function(s). 

4. 2. 2 Failure Mode 

The entries in this column describe briefly the manner in which the equipment 
malfunctions. The failure modes in this analysis only describe possible 
unsatisfactory performance without reference to probability of occurrence or 
confidence in the probability. 

4. 2. 3 Effect of Failure 

Since crew safety is a primary concern, the effects of failures indicated in this 
column are those representing safety hazards to the crews of either the resupply 
or user OVs. In the case of components, any effect(s) on crew safety may be 
indirect one(s). 
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Failure Effect of Hazard Desi g n and Operational Guidelines 

Nomenclature Modes Failure Classification Preventive I Remedial 
















4. 2. 4 


Hazard Classification 


This column classifies the effect(s) of the failure on OPD operation according 
to the standard NASA Hazard categories. The hazard categories are contained 
in Appendix C for the convenience of the reader. 

4. 2. 5 Design and Procedural Guidelines 

This column contains two subheadings; preventive and remedial. The data 
contained in the preventive category provide guidelines for inputs to engineered- 
in design and procedural requirements that will enhance system safety. Where 
applicable, the remedial column contains inputs for contingency operation(s) 
should failure(s) occur. 

4. 3 ANALYSIS OF SYSTEMS 

4. 3. 1 Propellant Storage Tank System 

4. 3. 1. 1 Functional Discription 

The propellant storage tank system consists of the propellant tank proper and 
all associated components, such as valving, fluid condition sensing meters, 
etc. (See Figure 4-1 for typical integral system tank schematic. ) The primary 
function of the propellant tanks is to store (maintain) and condition the propellants 
Both hydrogen and oxygen use autogenous pressurization, and, conceptually, the 
tanks are identical except for their respective sizes. The propellant tanks 
store propellants in a zero-g condition. 

4. 3. 1.2 Hazard Analysis 

The major hazard associated with the propellant tanks is the mixing of the 
propellants which can result in a potentially explosive condition. This and other 
hazards are analyzed in Tables 4-2, 4-3, and 4-4. 

4. 3. 2 Secondary Propulsion System (SPS) 

4. 3. 2. 1 Functional Description 

The secondary propulsion system (SPS) provides the necessary OPD acceleration 
for phase control during propellant transfer. The required level of acceleration 
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Figure 4-i. Propellant Transfer Schematic, Integral Concept 



Table 4-2. OPD Propellant Tank Components, Integral and 
Semimodular Concepts 
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Propellant storage Transfer line leakage High overboard dump rate Catastrophic 1. Monitor flow rate out of OPD Shutdown system, locate leak 

tank during active pumping with possible propellant I and into user OV tanks and fix by EVA 

residing near OPD ‘ 2 . Automatic shutdown if flow- 

Prope llant storage potential combustible rates are different 

condition 
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Table 4-4. Propellant Tank Hazards Analysis, Modular Concept 



4-7 




-5 -4 

is on the order of 10 to 10 g's. A linear acceleration method was 
selected for this application (see Appendix A). The basic components within 
the SPS shown in Figure 4-2 and Table 4-5 are: (i) the start tanks which are 

capillary retention devices capable of propellant feed in a zero-g environment; 
and (ii) the engine thrusters. After acceleration is effected with feed from the 
start tanks, SPS propellants are obtained from the main tanks to sustain the 
required level of acceleration for the duration of the propellant transfer 
operation. 

4. 3.2.2 Hazard Analysis 

The primary failure modes of the SPS are its inability to control acceleration 
and its inability to effect acceleration; in either case, the result would be the 
nontransfer of propellants. In addition, the former could result in not being 
able to uncouple the affected OV from the OPD. These hazards are discussed 
further in Table 4-6. 

4. 3. 3 Pressurization System 

4. 3. 3. 1 Functional Description 

The pressurization system provides the necessary net positive suction head 
(NPSH) of propellant settling to effect pump transfer. The system is an 
autogeneous warm, gas -pressurization system and is also a bootstrap system 
where propellant is taken downstream from the transfer pump and passed 
through a vaporizer. The primary components in the pressurization system 
are the heat exchangers and the pressure- and flow -regulating valves, 

Figure 4-3 and Table 4-7. 

4. 3. 3. 2 Hazard Analysis 

A hazard associated with the pressurization system (see Table 4-8) is 
uncontrolled overpressurization of the donor tank which cannot be relieved by 
the tank pressure relief system. The result of such a failure would be a 
propellant tank explosion with possible failure of the entire OPD. 
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igure 4-2. Secondary Propulsion System Schematic 







Table 4-5, Secondary Propulsion System Start Tanks 

1. Provides OPD Linear Acceleration to Settle Liquid 

2. Start Tanks 

a. Capable of zero-g operation 

b. Fed from propellant tank 

3. Components 

a. Pumps 

b. Flowmeters 

c. Valves 

d. Heat exchangers 

1) Heat propellants 

2) Liquid /vapor interface 

e. Combustion chambers 

4. Interfaces 

a. Propellant tanks 

b. Gas generator 
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Table 4-6. Secondary Propulsion System Hazard Analysis 
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Figure 4-3. Pressurization System Schematic 






Table 4-7. OPD Pressurization System 

1. Provides NPSH to Propellants 

2. Oxygen 

a. Helium Pressurization 

1) Stored high pressure helium 

2) He heater to ~500 R 

b. Components 

1 1) High pressure helium tank 

2) Valves 

3) Heat exchangers 

4) Pressure/temperature sensors 

c. Interfaces 

1) Oxygen tank 

2) Gas generator 

3. Hydrogen 

d. Hydrogen Pressurization 

1) bled from main tank 

2) H.2 heated to ~ 500 R 

e. Components 

1 ) Valve s 

2) Pump 

3) Flowmeter 

4) Heat exchanger 

5) Pres sure /temperature sensor 

f. Interfaces 

1) Hydrogen tank 

2) Gas generator 
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4. 3. 4 Gas Generator System (GGS ) 

4. 3. 4. 1 Functional Description 

The gas generator provides thermal energy to the pressurization system and to 
the secondary propulsion system. It is basically a combustion canister using 
oxygen and hydrogen as reactants to generate thermal energy. The hot gas 
products are passed through heat exchangers where pressurant gas and SPS 
propellants are heated. The primary components within the gas generator 
system are the combustion canister and the heat exchangers; a schematic of 
the system is presented in Figure 4-4 and a listing of the components is in 
Table 4-9. 

4. 3. 4. 2 Hazard Analysis 

The major hazards associated with this system are the loss of oxidizer /fuel 
mixture control and the leakage of combustion gas products into the pressuri- 
zation system. These hazards are listed in Table 4-10. 

4. 3. 5 Vent System 

4. 3. 5. 1 Functional Description 

The propellant tank vent system has a three-fold function: (i) relieve excessive 
propellant tank pressure caused by heat leaks into the tank; (ii) dump purge gas 
during a purging operation; and (iii) regulate tank pressure during a propellant 
transfer operation. The principle of thermodynamic conversion is utilized in 
the vent system to ensure that only vapors are vented. A schematic depicting 
the major components in the system is shown in Figure 4-5 and a listing of the 
components is in Table 4-11. 

Initial venting of the storage tanks releases both vapor and a quantity of liquid 
propellant. The liquid and vapor are separated after passing through the 
relief valve. The vapor goes directly to the vent branch of the system. The 
liquid is converted to a vapor by diverting it through a throttling valve and heat 
exchanger for use in cooling the main tanks; the resulting vapor goes to the vent 
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Figure 4-4. Gas Generator Schematic 





Table 4-9. Gas Generator System 


1. Provides Thermal Energy to Gas Generator System (GGS), 
Secondary Propulsion System(SPS), and 
Pressurization System 

2. Initial Reactants from Vent System 

3. After Start of SPS, Propellant Bled from Main Tanks 

4. Components 

a. Valves 

b. Pumps 

c. Flowmeters 

d. Heat exchangers 

e. High pressure vent storage tanks 

f. Combustion canister 

5. Interfaces 

a. Propellant tanks 

b. Vent system 

c. Pressurization system 

d. SPS 
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igure 4-5. Vent System Schematic (Thermodynamic Liquid and Vapor Separator) 






Table 4-11. OPD Vent System 


1. Provides Propellant Tank Pressure Relief 

2. Zero-g Vapor Venting 

3. Thermodynamic Liquid /Vapor Separator 

4. Vented Vapor Stored in GG Accumulators 

5. Components 

a. Valves 

b. Heat exchangers 

c. Overboard dump 

d. Pump 

e. Integrating flowmeter 

6. Interfaces 

a. Propellant tank 

b. Gas generator 
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branch of the system. In the vent branch, the vapors flow through an integrating 
flow meter which records the propellant loss due to venting. The vapors are 
subsequently pumped to storage accumulators and used for the initial start of 
the gas generator; the excess is vented overboard. 

4. 3. 5. 2 Hazard Analysis 

Table 4-12 contains the hazard analysis for this system. The major hazard 
associated with the vent system is its failure in either the open or closed 
position. The vent system should provide both redundancy and backup in the 
event of a failure. Manual override capability should also be incorporated so 
that portions of the systems can be isolated. 

4. 3. 6 Docking /Interface Mating System 

4. 3. 6. 1 Functional Description 

The purpose of this system is to secure the resupply or user OVs to the OPD 
during propellant transfer operations. The system also provides the capability 
for mating the propellant transfer interfaces. 

The primary components of the system are a universal docking adapter, locking 
latches, and transfer system interface connectors. The docking adapter is 
compatible with all vehicles servicing or being serviced by the OPD. The 
mechanism provides vehicle alignment in both axial and angular directions to 
facilitate docking. A series of hydraulic latches is mounted on the adapter 
to lock the vehicles together at completion of the docking operation. The trans- 
fer interface is comprised of the fluid and electrical connectors necessary to 
the propellant transfer operations. 

Since the details of the mating/transfer operations vary slightly for the different 
concepts and modes of operation, only a brief generalized description will be 
given here; a more detailed discussion occurs in Appendix B. 
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Figure 4-6 shows the basic steps in the docking /interface mating procedure. 

When the docking adapter is not in use, it is stored in the retracted position. 

As a vehicle approaches the OPD, the adapter is extended for the docking phase. 
When the vehicles are docked and the locking latches secured, the adapter is 
retracted. This properly positions the vehicle with respect to the OPD and 
enables the transfer interface connectors to be mated. When the propellant 
transfer is complete, the docking /mating procedures are reversed. 

4. 3. 6. 2 Hazard Analysis 

The following hazards analysis is divided into two sections. Tables 4-13 
through 4-19 apply to both the integral and semimodular concepts. Table 4-20 
applies to the modular concept. 

4. 4 COMPONENTS 

Although the various systems have individual system-peculiar components, many 
of the components are common to all of the systems. Consequently, the com- 
ponents were considered collectively and not as part of a system. On a compon- 
ent level basis, failure modes include electrical shortage, mechanical component 
failures, valve failure in the open/closed positions, etc. An analysis of the 
more critical components is presented in Table 4-20. Although none of the 
component failures per se will result in a catastrophic failure (except perhaps 
for the mixing of the propellant within the GG heat exchangers), the domino 
theory is very applicable to the propagation of failures from a component. 
Therefore, although a failure of a single component may appear to be relatively 
inconsequential in terms of a hazard classification, all due precautions must be 
used to prevent or remedy the possibility of a component failure from propagating 
to a total system failure. 

4. 5 INTERFACES 

Table 4-21 presents a matrix identifying the interfaces among the various 
systems; all but the power system interface were considered. The docking 
mechanism interface was discussed in paragraph 4. 3. 6. 
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Figure 4-6. Docking Configuration, Integral and Semimodular Concepts 



Table 4-13. OPD Resupply /Servicing Hazard Analysis, Integral and 
Semimodular Concepts 
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Table 4-15. OPD Resupply Fluid Interface Hazard Analysis, Integral and 
Modular Concepts 
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Table 4-19. OPD Resupply Docking System Hazard Analysis, Modular Concept 
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Table 4-21. System Interface Matrix 
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Table 4-22 delineates the interfaces and the failure modes which can exist 
across the interfaces. Generally, the most common type of failure is the 
nonscheduled transfer of propellant, electrical energy, etc. across an 
interface. 
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Table 4-22. Interface Hazards Analyses 
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5. SUMMARY AND CONCLUSIONS 


Three basic concepts of an OPD were assumed and evaluated to determine their 
respective safety hazards. Emphasis was placed on propellant transfer 
operations to and from the OPD, since these are the only occasions where 
manned vehicles would be involved in OPD operations. The concepts studied 
are summarized in Table 5-1. 

The study indicates that a modular mode of depot resupply is desirable 
regardless of the OPD configuration. This resupply mode requires no flow 
transfer to resupply either the semimodular or modular OPD. For the 
integral OPD, the modular method of resupply allows the resupply vehicle 
to move to a safe distance during the transfer operations. However, in the 
case of the modular OPD, the resupply module is considered to contain both 
LO^ and LH^, which necessitates the use of a common bulkhead type tank. 

The possibility of rupturing this bulkhead and the catastrophic nature of 
such a failure, either fire or explosion, weigh heavily against the modular 
depot as a candidate configuration. 

When servicing a user OV, the integral or semimodular OPD utilizes a 
propellant flow system to transfer propellants. The primary subsystems 
required for the transfer are ullage control, pressurization, and fluid flow, 
which are provided by linear accleration, liquid/ vapor conversion, and pump 
transfer, respectively. The level of hazard is the same for either of these 
two concepts during this phase of operation. 

The modular OPD transfers propellants by direct tank exchange. Direct 
tank exchange requires the user OV to dock its empty propellant tanks at the 
OPD and then maneuver with an auxiliary propulsion system to acquire a 
propellant tank from the OPD. The additional maneuvering required of the 
user OV in close proximity to the OPD, plus the use of common bulkhead 
type propellant tanks which are susceptible to damage resulting in catastrophic 
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Table 5-1. Summary of OPD Concepts 
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failure, as described above, raises the hazard level of the modular OPD above 
that for either the integral or semimodular OPD. 

A summary of typical catastrophic and critical safety hazards is presented 
in Tables 5-2 and 5-3, respectively. 

Of the threee concepts, the semimodular appears to provide the best opera- 
tional advantage and lowest safety risk. This concept does not require a 
flow transfer of propellants to resupply the OPD, as does the integral concept. 
Since propellant flow is not required, the risk to the resupply vehicle is 
minimized. Further, since single propellants, either L0 2 or are 

stored in individual modules, the likelihood of a single tank failure's incapac- 
itating the OPD is minimized. Rupturing a single module will not result in 
a catastrophic failure due to propellant mixing, as could occur with the tanks 
used in the modular concept. Additionally a ruptured module can be isolated 
from the system at the transfer manifold. This is in contrast with the single 
tank storage of each propellant in the integral concept wherein a single tank 
failure results in the loss of all OPD operations. 
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Table 5-2. Typical Catastrophic Hazards 
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